У меня есть сервер rsyslog и клиент. У меня есть сценарий bash с правилами iptables на обеих сторонах (клиент и сервер). Проблема в следующем: если я не запустил ни один сценарий bash, он работает. Если я запускаю только серверный сценарий bash, он также работает. Но когда я запускаю их обоих, это не работает. Итак, я понял, что политика DROP по умолчанию в клиенте отбрасывает пакеты, потому что они не совпадают. Я сомневаюсь, почему не совпадает или как должны выглядеть iptables.
Rsyslog работает на TCP-порту 514.
10.10.102.143это сервер rsyslog,10.10.102.138и10.10.102.146клиенты.
#!/bin/bash
# Defining the IPs and Networks
ETH0=10.10.102.
ETH1=10.10.150.
JUANMA=138
TAMARA=146
JOSE=143
EDUROAM=10.20.32.0/21
VPN=10.30.8.0/21
TEAMMATES=($JUANMA $TAMARA)
ETH0_LAN=($ETH0$JUANMA $ETH0$TAMARA)
ETH1_LAN=($ETH1$JUANMA $ETH1$TAMARA)
ALL_IPS=($EDUROAM $VPN ${ETH0_LAN[@]} ${ETH1_LAN[@]})
# Reset the configuration
iptables -F
# Drop all connectioins
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#### RSYSLOG ####
for NETWORK in $ETH0 $ETH1
do
for MATE in ${TEAMMATES[@]}
do
iptables -A INPUT -s $NETWORK$MATE -d $NETWORK$JOSE -p tcp -m state --state NEW,ESTABLISHED,RELATED --dport 514 -j ACCEPT
done
done
root@debian:/home/lsi# iptables-save -c
# Generated by iptables-save v1.6.0 on Sat Dec 7 19:53:43 2019
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [4:244]
[0:0] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -s 10.20.32.0/21 -d 10.10.102.143/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[2:128] -A INPUT -s 10.30.8.0/21 -d 10.10.102.143/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.10.102.138/32 -d 10.10.102.143/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.10.102.146/32 -d 10.10.102.143/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.10.150.138/32 -d 10.10.102.143/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.10.150.146/32 -d 10.10.102.143/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -p icmp -j ACCEPT
[0:0] -A INPUT -s 10.10.102.138/32 -d 10.10.102.143/32 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A INPUT -s 10.10.150.138/32 -d 10.10.150.143/32 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A INPUT -p tcp -m multiport --dports 80,443 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i eth0 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.10.102.138/32 -d 10.10.102.143/32 -p udp -m udp --dport 5555 -j ACCEPT
[0:0] -A INPUT -s 10.10.102.146/32 -d 10.10.102.143/32 -p udp -m udp --dport 5555 -j ACCEPT
[0:0] -A INPUT -s 10.10.150.138/32 -d 10.10.150.143/32 -p udp -m udp --dport 5555 -j ACCEPT
[0:0] -A INPUT -s 10.10.150.146/32 -d 10.10.150.143/32 -p udp -m udp --dport 5555 -j ACCEPT
[4:1212] -A INPUT -s 10.10.102.138/32 -d 10.10.102.143/32 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 514 -j ACCEPT
[0:0] -A INPUT -s 10.10.102.146/32 -d 10.10.102.143/32 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 514 -j ACCEPT
[0:0] -A INPUT -s 10.10.150.138/32 -d 10.10.150.143/32 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 514 -j ACCEPT
[0:0] -A INPUT -s 10.10.150.146/32 -d 10.10.150.143/32 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 514 -j ACCEPT
[0:0] -A OUTPUT -o lo -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.143/32 -d 10.20.32.0/21 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[1:88] -A OUTPUT -s 10.10.102.143/32 -d 10.30.8.0/21 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.143/32 -d 10.10.102.138/32 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.143/32 -d 10.10.102.146/32 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.143/32 -d 10.10.150.138/32 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.143/32 -d 10.10.150.146/32 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -p icmp -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.143/32 -d 10.10.102.138/32 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A OUTPUT -s 10.10.150.143/32 -d 10.10.150.138/32 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -o eth0 -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.143/32 -d 10.10.102.138/32 -p udp -m udp --sport 5555 -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.143/32 -d 10.10.102.146/32 -p udp -m udp --sport 5555 -j ACCEPT
[0:0] -A OUTPUT -s 10.10.150.143/32 -d 10.10.150.138/32 -p udp -m udp --sport 5555 -j ACCEPT
[0:0] -A OUTPUT -s 10.10.150.143/32 -d 10.10.150.146/32 -p udp -m udp --sport 5555 -j ACCEPT
COMMIT
# Completed on Sat Dec 7 19:53:43 2019
#!/bin/bash
JOSE=10.10.102.143
TAMARA=10.10.102.146
JOSE2=10.10.150.143
TAMARA2=10.10.150.146
JUANMA=10.10.102.138
iptables -F
iptables -X
iptables -Z
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A OUTPUT -s $JUANMA -d $JOSE -p tcp --dport 514 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
root@debian:/home/lsi# iptables-save -c
# Generated by iptables-save v1.6.0 on Sat Dec 7 19:52:18 2019
*filter
:INPUT DROP [4:1098]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
[2321:122582] -A INPUT -j LOG
[2317:121484] -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i lo -j ACCEPT
[0:0] -A INPUT -s 10.10.102.146/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.10.102.143/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.10.150.146/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.10.150.143/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.20.32.0/21 -d 10.10.102.138/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -s 10.30.8.0/21 -d 10.10.102.138/32 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -p icmp -j ACCEPT
[0:0] -A INPUT -s 10.10.102.146/32 -d 10.10.102.138/32 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A INPUT -s 10.10.102.143/32 -d 10.10.102.138/32 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A INPUT -s 10.10.102.143/32 -d 10.10.102.138/32 -p udp -m udp --sport 5555 -j ACCEPT
[0:0] -A INPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -p tcp -m multiport --dports 80,443 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -i eth0 -p udp -m udp --sport 53 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -o lo -j ACCEPT
[0:0] -A OUTPUT -d 10.10.102.146/32 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[26:2344] -A OUTPUT -d 10.10.102.143/32 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -d 10.10.150.146/32 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -d 10.10.150.143/32 -p tcp -m tcp --dport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.138/32 -d 10.20.32.0/21 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.138/32 -d 10.30.8.0/21 -p tcp -m tcp --sport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -p icmp -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.138/32 -d 10.10.102.146/32 -p udp -m udp --sport 123 -j ACCEPT
[0:0] -A OUTPUT -s 10.10.102.138/32 -d 10.10.102.143/32 -p udp -m udp --sport 123 -j ACCEPT
[1:88] -A OUTPUT -s 10.10.102.138/32 -d 10.10.102.143/32 -p udp -m udp --dport 5555 -j ACCEPT
[0:0] -A OUTPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -o eth0 -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
[2264:699505] -A OUTPUT -s 10.10.102.138/32 -d 10.10.102.143/32 -p tcp -m tcp --dport 514 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Sat Dec 7 19:52:18 2019
Заранее спасибо: P